Open
Conversation
Moving it to be able to use it globally later. Ticket: OISF#7888
This will be used to code the version of the log to use so backward compatibility can be achieved: upgrading Suricata without changing the configuration should not trigger major changes in the log format.
The app_proto is logged in a small subset (fileinfo, flow, frame, netflow) in Suricata when it is an interesting information for all events type as it includes detection information and protocol transition. This patch updates the code to log app_proto in all events if there is a Flow available. It is making use of EveAddAppProto function to get interesting information such as original application protocol or difference between server and client side. Backward compatibility is preserved as app_proto information will only be logged when the eve-log.version is greater or equal to 2. Ticket: 7888
Log the version of EVE used in the event.
regit
force-pushed
the
app_proto_logging-v2
branch
from
548c28a to
48ed06d
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #14760 +/- ##
=======================================
Coverage 82.15% 82.15%
=======================================
Files 1003 1003
Lines 263674 263708 +34
=======================================
+ Hits 216611 216649 +38
+ Misses 47063 47059 -4
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Make sure these boxes are checked accordingly before submitting your Pull Request -- thank you.
Contribution style:
https://docs.suricata.io/en/latest/devguide/contributing/contribution-process.html
Our Contribution agreements:
https://suricata.io/about/contribution-agreement/ (note: this is only required once)
Changes (if applicable):
(including schema descriptions)
https://redmine.openinfosecfoundation.org/projects/suricata/issues
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7888
Describe changes:
Provide values to any of the below to override the defaults.
SV_BRANCH=OISF/suricata-verify#2903